# US 11,444,759 B2 · Method and apparatus for cryptographically aligning and binding a secure element with a host device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,759 B2
- Document ID: US11444759B2
- Status: Granted
- Kind: B2
- Application number: 16/425,118
- Filed: 2019-05-29
- Published: 2020-12-03
- Granted: 2022-09-13
- Earliest claimed: 2019-05-29
- Assignees: STMicroelectronics S.r.l.
- Applicants: STMicroelectronics, Inc.
- Inventors: Giuseppe Pilozzi
- Web page: https://patentgrep.com/patent/US11444759B2

## CPC

- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- G06F 8/61: Installation
- G06F 11/1451: {by selection of backup contents}
- G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00)
- H04L 9/0822: {using key encryption key}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY

## Abstract

A method of cryptographically binding a secure element to a host device includes storing host key information in a host key information slot of the secure element and storing binding information in secure memory of the secure element. The binding information is correlated with the host key information. The method includes storing a second secret key within system operational code of the host device. The second secret key is cryptographically correlated with the host key information. The method includes, after storing the binding information and after storing the second secret key, operationally coupling the secure element to the host device, reading, by the host device, the binding information from the secure element, generating, by the host device, the host key information using the binding information and the second secret key, and storing, by the host device, the host key information in a host key information slot of the host device.

## Claims

### Claim 1

A method of cryptographically binding a secure element (SE) to a host device (HD), the method comprising:
storing host key information HKSE in an SE-HKSE slot of the secure element;
at a first location, storing binding information BSE in secure memory of the secure element, wherein the binding information BSE is cryptographically correlated with the host key information HKSE;
at a second location remote to the first location, storing a second secret key SK2 within system operational code stored in protected memory of the host device, wherein the second secret key SK2 is cryptographically correlated with the host key information HKSE; and
at a third location, after storing the binding information BSE, and after storing the second secret key SK2, cryptographically binding the secure element to the host device by
operationally coupling the secure element to the host device,
reading, by the host device, the binding information BSE from the secure element,
generating, by the host device, the host key information HKSE using the binding information BSE and the second secret key SK2, and
storing, by the host device, the host key information HKSE in an HD-HKSE slot of the host device, wherein the secure element and the host device are collocated at the third location, and wherein the third location is remote to both the first location and the second location.

### Claim 2 (depends on 1)

The method of claim 1, wherein:
the binding information BSE comprises encrypted host key information CHKSE;
the encrypted host key information CHKSE is encrypted using a symmetric-key cryptographic algorithm; and
storing the host key information HKSE in the SE-HKSE slot of the secure element comprises storing the host key information HKSE in the secure element at the first location.

### Claim 3 (depends on 1)

The method of claim 1, wherein:
the binding information BSE is a secure element public key PSE;
the second secret key SK2 is a host device private key nHD; and
generating the host key information HKSE comprises creating, by the host device, the host key information HKSE using the secure element public key PSE and the host device private key nHD.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
at the first location, storing a first secret key SK1 in the secure memory of the secure element, wherein the first secret key SK1 is a secure element private key nSE;
at the third location and after operationally coupling the secure element to the host device
sending, by the host device, a host device public key PHD to the secure element, and
creating, by the secure element, the host key information HKSE using the host device public key PHD and the secure element private key nSE; and
wherein storing the host key information HKSE in the SE-HKSE slot of the secure element comprises storing the host key information HKSE at the third location after creating the host key information HKSE using the host device public key PHD and the secure element private key nSE.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
generating, by a first hardware security module HSMSE at the first location, a first secret key SK1;
generating, by a second hardware security module HSMHD at the second location, the second secret key SK2; and
wherein steps performed at the third location are performed without using a hardware security module.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
storing a secure-backup-data file in secure memory of the secure element, wherein the secure-backup-data file comprises encrypted host key backup information usable to recover host devices for which the host key information HKSE stored in the HD-HKSE slot of the host device has become corrupted.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
at the first location and before operationally coupling the secure element to the host device, preinstalling a wrapped license key K1 into the secure memory of the secure element, the wrapped license key K1 corresponding to proprietary executable computer code; and
at the third location and after storing the host key information HKSE in the HD-HKSE slot of the host device,
using, by the host device, the secure element as a hardware license to verify permission to install the proprietary executable computer code by unwrapping the wrapped license key K1 using the host key information HKSE, and
installing, by the host device, the proprietary executable computer code in the host device.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
after using the secure element as the hardware license, decrementing a counter of the secure element, wherein the counter tracks a quantity of installations of the proprietary executable computer code, and wherein the secure element is configured to disallow installation of the proprietary executable computer code when the counter is equal to zero.

### Claim 9

A method of cryptographically aligning a secure element (SE) with a host device (HD), the method comprising:
generating a secure element-diversified key KSE as a function of a master key KM and a secure element unique identifier UIDSE;
encrypting host key information HKSE using the secure element-diversified key KSE to generate encrypted host key information CHKSE, wherein the host key information HKSE uniquely corresponds to the secure element;
storing the host key information HKSE in a SE-HKSE slot of the secure element;
storing the encrypted host key information CHKSE in secure memory of the secure element; and
obfuscating the master key KM using a host device unique identifier UIDHD to generate a host device-obfuscated key KHD within system operational code stored in protected memory of the host device.

### Claim 10 (depends on 9)

The method of claim 9, wherein:
generating the secure element-diversified key KSE further comprises generating the secure element-diversified key KSE as a function of
the master key KM,
the secure element unique identifier UIDSE, and
a batch password; and
obfuscating the master key KM further comprises obfuscating the master key KM using the host device unique identifier UIDHD and the batch password.

### Claim 11 (depends on 9)

The method of claim 9, further comprising:
operationally coupling the secure element to the host device; and
executing the system operational code by the host device, wherein executing the system operational code comprises
reading the encrypted host key information CHKSE and the secure element unique identifier UIDSE from the secure element,
reversing obfuscation of the host device-obfuscated key KHD to generate the master key KM,
decrypting the encrypted host key information CHKSE using the master key KM and the secure element unique identifier UIDSE to generate the host key information HKSE, and
storing the host key information HKSE in an HD-HKSE slot of the host device.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
after storing the host key information HKSE in the HD-HKSE slot of the secure element and before executing the system operational code, instructing the secure element to
wrap a proprietary information key Kin to form a wrapped proprietary information key WKPI, and
store the wrapped proprietary information key WKPI in the secure memory of the secure element;
sending encrypted proprietary information to the host device; and
wherein executing the system operational code further comprises
reading the wrapped proprietary information key WKPI from the secure element,
using the host key information HKSE stored in the HD-HKSE slot of the host device, instructing the secure element to unwrap the wrapped proprietary information key WKPI and provide the proprietary information key Kin to the host device, and
decrypting the encrypted proprietary information using the proprietary information key KPI.

### Claim 13 (depends on 11)

The method of claim 11, further comprising:
before executing the system operational code, sending an initiate command to the host device triggering boot-up of the system operational code, wherein the initiate command includes a batch password; and
wherein executing the system operational code further comprises
unlocking the secure element using the batch password.

### Claim 14 (depends on 11)

The method of claim 11, further comprising:
after storing the host key information HKSE in the HD-HKSE slot of the host device, deleting the master key KM and the host device-obfuscated key KHD from the host device.

### Claim 15

A method of cryptographically binding a secure element (SE) to a host device (HD), the method comprising:
storing a secure element private key nSE in secure memory of the secure element;
creating a secure element public key PSE using the secure element private key nSE;
storing a host device private key nHD within system operational code stored in protected memory of the host device;
operationally coupling the secure element and the host device; and
cryptographically binding the secure element to the host device by executing the system operational code by the host device, wherein executing the system operational code comprises
reading the secure element public key PSE from the secure element,
creating host key information HKSE using the host device private key nHD and the secure element public key PSE, and
storing the host key information HKSE in a HD-HKSE slot of the host device.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
before operationally coupling the secure element to the host device,
creating a host device public key PHD using the host device private key nHD,
creating the host key information HKSE using the secure element private key nSE and the host device private key nHD, and
storing the host key information HKSE in a SE-HKSE slot of the secure element.

### Claim 17 (depends on 15)

The method of claim 15, further comprising:
wherein executing the system operational code further comprises
creating a host device public key PHD using the host device private key nHD, and
sending the host device public key PHD to the secure element;
creating, by the secure element, the host key information HKSE using the secure element private key nSE and the host device public key PHD; and
storing, by the secure element, the host key information HKSE in a SE-HKSE slot of the secure element.

### Claim 18 (depends on 15)

The method of claim 15, further comprising:
after storing the host key information HKSE in the HD-HKSE slot of the host device, deleting the host device private key nHD from the host device.

### Claim 19 (depends on 15)

The method of claim 15, further comprising:
generating, by a secure element hardware security module, a secure element certificate;
storing the secure element certificate in the secure element;
generating, by a host device hardware security module, a host device certificate;
storing the host device certificate in the host device; and
after operationally coupling the secure element and the host device,
verifying, by the host device, that the secure element is authorized to pair with the host device by validating the secure element certificate using a secure element public key, and
verifying, by the secure element, that the host device is authorized to pair with the secure element by validating the host device certificate using a host device public key.

### Claim 20 (depends on 15)

The method of claim 15, further comprising:
before executing the system operational code, sending an initiate command to the host device triggering boot-up of the system operational code, wherein the initiate command includes a batch password; and
wherein executing the system operational code further comprises
unlocking the secure element using the batch password.